Identify the source of authority
Record how each category was created or obtained and which contracts, notices or permissions govern it. Distinguish material authored by the business from content received from others. A service contract may authorize operations without authorizing outside AI training.
Review the proposed use
Permissions suitable for internal analysis may not cover transfer to a model developer. Consider confidentiality, privacy, intellectual property and sector-specific obligations with qualified reviewers. Country and jurisdiction affect the analysis; this guide does not establish compliance.
Keep decisions traceable
Maintain an inclusion and exclusion record linked to the dataset version. Record unresolved questions and their owners. If one category cannot be cleared, exclude it or stop that part of the project rather than treating a broad company-level approval as sufficient.
Practical guidance, not legal advice or a buyer specification. Examples are illustrative. Reviewed October 20, 2026.